Skip to content

pam: patch CVE-2024-22365 #8320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Redent0r merged 1 commit into from
Mar 8, 2024
Merged

pam: patch CVE-2024-22365 #8320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions SPECS/pam/CVE-2024-22365.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
From 031bb5a5d0d950253b68138b498dc93be69a64cb Mon Sep 17 00:00:00 2001
From: Matthias Gerstner <matthias.gerstner@suse.de>
Date: Wed, 27 Dec 2023 14:01:59 +0100
Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent
local DoS situations

Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
being placed in user controlled directories, causing the PAM module to
block indefinitely during `openat()`.

Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
refer to a directory.

With this the check whether the final path element is a directory
becomes unnecessary, drop it.
---
modules/pam_namespace/pam_namespace.c | 18 +-----------------
1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
index 2528cff86..f72d67189 100644
--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -1201,7 +1201,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
int dfd = AT_FDCWD;
int dfd_next;
int save_errno;
- int flags = O_RDONLY;
+ int flags = O_RDONLY | O_DIRECTORY;
int rv = -1;
struct stat st;

@@ -1255,22 +1255,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
rv = openat(dfd, dir, flags);
}

- if (rv != -1) {
- if (fstat(rv, &st) != 0) {
- save_errno = errno;
- close(rv);
- rv = -1;
- errno = save_errno;
- goto error;
- }
- if (!S_ISDIR(st.st_mode)) {
- close(rv);
- errno = ENOTDIR;
- rv = -1;
- goto error;
- }
- }
-
if (flags & O_NOFOLLOW) {
/* we are inside user-owned dir - protect */
if (protect_mount(rv, p, idata) == -1) {
9 changes: 7 additions & 2 deletions SPECS/pam/pam.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: Linux Pluggable Authentication Modules
Name: pam
Version: 1.5.1
Release: 5%{?dist}
Release: 6%{?dist}
License: BSD and GPLv2+
URL: https://github.com/linux-pam/linux-pam
Source0: https://github.com/linux-pam/linux-pam/releases/download/v%{version}/Linux-PAM-%{version}.tar.xz
Expand All @@ -14,6 +14,8 @@ BuildRequires: audit-devel
Requires: audit-libs
Recommends: cracklib-dicts

Patch0: CVE-2024-22365.patch

%description
The Linux PAM package contains Pluggable Authentication Modules used to
enable the local system administrator to choose how applications authenticate users.
Expand All @@ -36,7 +38,7 @@ This package contains libraries, header files and documentation
for developing applications that use pam.

%prep
%autosetup -n Linux-PAM-%{version}
%autosetup -n Linux-PAM-%{version} -p1

%build
./configure \
Expand Down Expand Up @@ -98,6 +100,9 @@ EOF
%{_docdir}/%{name}-%{version}/*

%changelog
* Fri Mar 08 2024 Saul Paredes <saulparedes@microsoft.com> - 1.5.1-6
- Add patch for CVE-2024-22365

* Tue Mar 22 2022 Andrew Phelps <anphel@microsoft.com> - 1.5.1-5
- Require audit-libs

Expand Down
8 changes: 4 additions & 4 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,10 +281,10 @@ p11-kit-debuginfo-0.24.1-1.cm2.aarch64.rpm
p11-kit-devel-0.24.1-1.cm2.aarch64.rpm
p11-kit-server-0.24.1-1.cm2.aarch64.rpm
p11-kit-trust-0.24.1-1.cm2.aarch64.rpm
pam-1.5.1-5.cm2.aarch64.rpm
pam-debuginfo-1.5.1-5.cm2.aarch64.rpm
pam-devel-1.5.1-5.cm2.aarch64.rpm
pam-lang-1.5.1-5.cm2.aarch64.rpm
pam-1.5.1-6.cm2.aarch64.rpm
pam-debuginfo-1.5.1-6.cm2.aarch64.rpm
pam-devel-1.5.1-6.cm2.aarch64.rpm
pam-lang-1.5.1-6.cm2.aarch64.rpm
patch-2.7.6-8.cm2.aarch64.rpm
patch-debuginfo-2.7.6-8.cm2.aarch64.rpm
pcre-8.45-2.cm2.aarch64.rpm
Expand Down
8 changes: 4 additions & 4 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,10 +287,10 @@ p11-kit-debuginfo-0.24.1-1.cm2.x86_64.rpm
p11-kit-devel-0.24.1-1.cm2.x86_64.rpm
p11-kit-server-0.24.1-1.cm2.x86_64.rpm
p11-kit-trust-0.24.1-1.cm2.x86_64.rpm
pam-1.5.1-5.cm2.x86_64.rpm
pam-debuginfo-1.5.1-5.cm2.x86_64.rpm
pam-devel-1.5.1-5.cm2.x86_64.rpm
pam-lang-1.5.1-5.cm2.x86_64.rpm
pam-1.5.1-6.cm2.x86_64.rpm
pam-debuginfo-1.5.1-6.cm2.x86_64.rpm
pam-devel-1.5.1-6.cm2.x86_64.rpm
pam-lang-1.5.1-6.cm2.x86_64.rpm
patch-2.7.6-8.cm2.x86_64.rpm
patch-debuginfo-2.7.6-8.cm2.x86_64.rpm
pcre-8.45-2.cm2.x86_64.rpm
Expand Down